{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89405520-ad45-54c8-a89a-9d25b808489f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "version": "2.0.7.post4+tuxcare", "pedigree": { "ancestors": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@2.0.7", "type": "library", "version": "2.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-33503", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:c0a08a19-870d-5277-82f1-a9f9cc81c037", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33503 affects version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2023-43804", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:caa0ba30-b5ad-5a7f-9ed4-292604b94d34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-43804 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th...", "justification": "code_not_present" } }, { "id": "CVE-2023-45803", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:8c556101-73fb-53e3-b9be-86ca7a03410a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45803 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,...", "justification": "code_not_present" } }, { "id": "CVE-2024-37891", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:c773071b-f6c7-5f5c-a4bf-60669dee2f65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-37891 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2025-50181", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:7e3f433c-fff7-5f57-bcbb-359b1be5864c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-50181 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2025-50182", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:85c06e83-46cf-5388-8c5d-6fab90a5c405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-50182 affects version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2025-66418", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:5a4d3318-1ea5-5d7f-8bb8-2ea6425adb79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66418 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2025-66471", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:9f291096-126a-5d15-893c-7386684bcbaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66471 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2026-21441", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:ff653269-b6d4-590a-98eb-374f20e4dce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-21441 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2026-44431", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:b7f16c47-edde-5c7e-ae73-54e70bd11b71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44431 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2026-44432", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:0d72c554-80ef-5af4-9100-4d524401932f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44432 affects version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2026-97687", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:6d42853d-c4a9-5a93-b7d8-d08191d67f99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97687 is fixed in version 2.0.7.post4+tuxcare of urllib3." } }, { "id": "CVE-2026-97688", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:537eae7c-14e2-5603-949a-1f35251428d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-97688 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming...", "justification": "code_not_present" } }, { "id": "CVE-2026-97689", "affects": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ], "bom-ref": "urn:uuid:b4ea3476-816a-5c0f-9ae6-9bd1f430eeae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97689 is fixed in version 2.0.7.post4+tuxcare of urllib3." } } ], "dependencies": [ { "ref": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } ] }